Hacker News new | past | comments | ask | show | jobs | submit login
A discussion of Fedora’s legal state (lwn.net)
198 points by sohkamyung on Feb 16, 2017 | hide | past | favorite | 77 comments



Some of that reminds me when we tried to clean up the licensing situation in Gentoo.

There's an incredible amount of self-invented licenses and if there's one advice I'd like to give to all free and open source devs: Don't do this. It annoys people in Linux distros who have to decide what to do with your code, whether it's free and there almost certainly is an existing, widely used license that does what you want. Choose one of the mainstream licenses like MIT, GPL (2 or 3, whatever, we know what it means, it's fine), Apache-2 or even something like WTFPL. It's all fine, we know what it means. But don't pick three chapters of license A and one of License B to have your unique mix.

I also remember we had a LICENSE as-is, which was supposed to mean something very specific, but it had a horrible result: Many devs used it as the license dumpster: "I don't know what license it is, so I'll tag it as 'as-is'." Thanks to lots of work, mostly done by Ulrich Müller, all of that mess is now cleaned up.


>even something like WTFPL

In 2009, the Open Source Initiative chose not to approve the license as an open-source license.

https://en.wikipedia.org/wiki/WTFPL#Discussion

https://opensource.org/minutes20090304


When you say such things you should also mention that they did not approve it because it is redundant to https://en.wikipedia.org/wiki/Fair_License

I.e. they're not saying it's bad, just superfluous.

Also, i wonder what effect approval/rejection by the OSI has in any case. Does anyone care what they say?


Yeah, first I wanted to write CC0, but OSI also doesn't like that. But honestly, there's enough wtfpl code out there that it seems nobody has a big issue with it. And given hat it allows relicensing into any other free license it seems more a semantic issue.

Is there a widely accepted "do anything you like"-license that everyone can agree upon? I noticed github had cc0 for a while, but now they offer "the unlicense".


No. The FSF is broadly approving of the unlicense but recommends CC0 above it: https://www.gnu.org/licenses/license-list.en.html#Unlicense . The OSI has a specific concern about the patent language in CC0 and does not generally approve of public domain dedications; I don't see any specific concern about the unlicense though. Debian doesn't have any coments about either as far as I know.

It sounds to me like the unlicense is the best option - the OSI's concern about CC0 sounds reasonable to me, and the WTFPL doesn't have any fallback for jurisdictions that consider public domain dedications invalid.


The Unlicense seems to be unapproved by OSI as well. I'm getting the impression the OSI for some reason doesn't want to approve any license without restrictions.

One option is of course to "hack" the osi approval by, e.g., saying "this is licensed under CC0, alternatively it's licensed under MIT". (MIT is just an example and can be replaced with any other OSI-approved license). But it seems a bit stupid that there isn't an easy solution for this.


The OSI doesn't want to approve any public domain dedication, they believe it's better to use an open-source license (or else that a public domain dedication is outside their scope, since in a technical sense it isn't necessarily a license). I don't know why they evaluated the fallback license of CC0 and didn't evaluate the fallback license of Unlicense - maybe it's just a question of it never being submitted by the authors?


> The OSI doesn't want to approve any public domain dedication, they believe it's better to use an open-source license

I've heard that the ability to dedicate your work to the public domain may not be possible in some European jurisdictions, and this concern was why public domain dedications were frowned upon.


The Unlicense was never submitted for OSI approval.


In the past couple of years the OSI approved a license that essentially has no restrictions: https://opensource.org/licenses/FPL-1.0.0


Cool. Sadly looks like the FSF haven't commented on it?


What's wrong with the MIT license? It's almost the same as WTFPL, but actually recognised.


MIT and all other BSDish licenses require attribution.

There's an understandable wish by some people to just radically reduce the complexity of this whole topic. I don't want to have to say "You can use this for whatever, you just have to ...", even if "..." just means "you have to keep this line with the copyright info". I simply want to be able to say "you can use this for whatever you want, no restrictions".


Attribution does prevent the case where someone else takes your code, relicenses it under their name with a different license, and effectively locks you out of the house you built. (I know, it's hard to believe anyone would be so dishonest and petty, isn't it? That's where the complexity comes from.)


I'd mostly be worried about that case if they, afterwards, decided to sue me for copyright infringement of my own code. I expect that that could be a difficult situation to explain in court. "Yes, your honor, I wrote the software, gave it away for free, and said that someone else could take credit." It just sounds weird, and I think it'd be a somewhat foreign concept for most people.

If I'm putting my stuff out on WTFPL, it basically implies that I'm already OK with someone taking it, relicensing it, and distributing it under a new license (and even under a new attribution). Personally, I would have a problem with it, so I've never licensed anything under WTFPL.


> What's wrong with the MIT license?

Navigate to about:license in Firefox. Does it seem like a good idea to have to reproduce every variant (with each unique notice) of MIT and BSD license?


If you actually want your software used, then a known license is the best. In a corporate environment, it will be much easier to approve BSD or even GPL than WTFPL. There's most likely a preapproved list of known licenses and everything else needs to go through legal.

You want your library used in the next big project? Don't use WTFPL.


> In a corporate environment, it will be much easier to approve BSD or even GPL than WTFPL.

This is false in the large corporate environments I've worked in. The WTFPL is sufficiently established and mainstream that legal knows what it is and has a position that it's fine. Use of anything GPL requires a lot more specific review to ensure we'll be compliant.


Yet true in my corporate environment. Corporate environments can differ.


I'm amazed. Your legal department is happy to approve the GPL (a long license that imposes significant obligations if you distribute anything) but not the WTFPL? I can understand maybe the WTFPL simply isn't on the list yet (though I'm still amazed they wouldn't put strict requirements on use of anything GPL, because you can't "statically" comply with the GPL - you have to take particular actions every time you distribute a derived work, and legal would need to be confident this was happening), but that's a one-time cost, and there's enough WTFPL software out there for it to be worthwhile.


A lot of companies have policy to always include license documents in specific place where customer can see it.

Very few companies are fine to write "fuck" in documents that reaches customers. Very few are fine to have no license attached to software.

A lot of companies distribute unmodified GPL software and have no issue with including the GPL licensing text (and source code) in ways that reaches customers.


> Very few companies are fine to write "fuck" in documents that reaches customers. Very few are fine to have no license attached to software.

Redistribute it under another license then? The WTFPL gives you permission to do that, after all.

> A lot of companies distribute unmodified GPL software and have no issue with including the GPL licensing text (and source code) in ways that reaches customers.

It's perfectly doable. But it's nonzero effort and it creates an ongoing obligation (as long as you're going to keep distributing the software, or something like 3 years after if you do the more customer-friendly thing of only distributing the source on request). I'm not surprised that a company would do it, but I'm amazed that a company would consider it less burdensome than the WTFPL.


Yes, writing a new license and just use that would be the better solution, but its in direct contrast to how companies handle software license. You don't generally take software and then replace the license with your own and pretend that the original license don't exist, even if the license do permits it.

As for the GPL ongoing obligation, I am not sure how many picks the source-on-request method or the subgroup of those that also get a request. Its a fix-it-later issue compared to the more immediate issue of "fuck" appearing in the product.

Just to be a bit clearer on my own opinion, a good company should have no issue of using both licenses. Writing code is costly and time consuming, and a good company should focus on core aspects rather than reinventing programming infrastructure. If the license is compatible with the business model then use it. If its not, ask the author for a exception. If all fails, then and only then waste developers time. In video games I often see software licenses in game credits, and many game studios will use any and all licenses that isn't in direct conflict with the business model, and I assume its because that market is too competitive to not do so. Including LGPLv3 source code on the disk (or offering) isn't a big deal compared to a game shipping a month or two later.


> You don't generally take software and then replace the license with your own and pretend that the original license don't exist, even if the license do permits it.

Sure, it's a slightly unusual thing to do. But I think it's less unusual than what you have to do for GPL compliance.

> As for the GPL ongoing obligation, I am not sure how many picks the source-on-request method or the subgroup of those that also get a request. Its a fix-it-later issue compared to the more immediate issue of "fuck" appearing in the product.

Legal should not be treating it as a fix-it-later issue if they're caring about licensing at all. Distributing GPL code not in compliance with the license is exactly as bad as distributing code you have no license to at all (and opens you up to exactly the same liability, given that the damages for copyright infringement are statutory).

Don't get me wrong, I support the GPL, but license compliance is important and nontrivial. Note that the LGPL is a very different license from the GPL, and much easier to comply with.


Not sure I really buy this. I have at least one project[1] that lots of people use despite the WTFPL. I don't use the WTFPL any more though.

There's also SQLite, which is probably one of the most widely use libraries in existence. It's in the public domain.

[1] - https://github.com/BurntSushi/toml


> It's in the public domain.

With an additional license for countries, like Germany, where the public domain doesn’t exist (as copyright isn’t really a thing, but only "creator rights" and "usage rights")


Why not? It is basically a public domain license, it just uses more colorful language. IANAL, but I see no problem using such code in corporate environment. What are the risks?


It's very unclear how it works around the world in different legal systems. In comparison the CC0 spends a lot of words to work with all the jurisdictions where you can't legally give up all rights over a work.

If you are operating internationally (like nearly the entire tech industry), complying in as many jurisdictions as possible is very valuable


YANAL, and IANAL, but those who are, are always suspicious of modified license texts. They always fear there's a hidden catch that the language (colourful or not) tries to hide and get you tricked. And they are not entirely unjustified to do so.

Also, in a corporate environment, there's typically some additional overhead cost and bureaucracy and approvals that a new license text brings in, even when the engineers and lawyers manage to agree everything is OK.


I don't think there's a problem. The situation I experienced is just that standard OSI licenses are preapproved. Anything else needs to go via manual process which takes days/weeks. So even if you say "do whatever you want", it's not a standard OSI license which means I have to get a confirmation first. And if I can find/write an alternative quicker, I will.


There actually is a problem: There’s countries where "public domain" is not a thing, so the WTFPL becomes legally the same as "all rights reserved".

Which is a problem.


WTFPL lacks a disclaimer of the implied warrant of merchantability. If you're the author of such code, you could be sued for damages if there is a bug in it.


Ha! Now I can use Java in my nuclear submarine! Was too busy drinking martinis in my lair to notice that Sun finally caved. Begone, Perl 6 guidance systems! Welcome, MissilePrelaunchFactoryInit class!


Just be careful translating that 150 character regexp that transforms the target's GPS co-ordinates into the missile's native co-ordinate projection system.


What missiles? He just has a nuke powered fishie observation vessel.


So the MissilePrelaunchFactoryInit class is for managing the 'launch' of a fish observation application called Missile? Got it. My bad.


No, it's supposed to be MissalPrelaunchFactoryInit, but the class name spellcheck in Eclipse autocorrected it. It's so you can tell the fish about their lord and saviour Jesus Carp.


So we're ok with invading the privacy of aquatic animals now?


If they clearly mark their private area with approved warning signs and submit a privacy request notification form in triplicate at any US consulate, they can have all the privacy they want. Subject to exceptions* granted in the Patriot Act and other relevant legislation.

* Warning - no actual grant of privacy included.


Putting Java on nuclear subs would allow the Bulletin of Atomic Scientists to turn the doomsday clock back by ten minutes or so, thanks to the infamous InvalidCoordinateArgumentYouCannotTargetTheMoonException. ;-)


Contribution agreements without assigning copyright seem to be a missing part of FOSS legal infrastructure. Everyone knows the standard open-source licenses, but there's no standard text you can have contributors sign to say that they understand that they're irrevocably licensing their contributions to you under that license. I ended up adapting the text from https://en.wikipedia.org/wiki/Wikipedia:Declaration_of_conse... for my own project, but it would be good to have a well-known standardised statement along these lines.


> there's no standard text you can have contributors sign to say that they understand that they're irrevocably licensing their contributions to you under that license

If you feel you need something like that, use the Developer Certificate of Origin: https://developercertificate.org/

That's what "Signed-off-by:" lines indicate agreement with, and conveniently, git has built-in support for adding such lines.


Thanks, I wasn't aware of that. That said I'd prefer something closer to the Wikipedia language; I'd like it to be clearer that I might not retain contributions, and that contributions may be modified by subsequent contributors.

> That's what "Signed-off-by:" lines indicate agreement with

Not to me (I've been using -s for years, assuming it was just a way to include developer information in the commit message), so I doubt that would hold up in court.


Nobody's mentioned this, so here you go: the (apparently just 19:38) video.

https://fosdem.org/2017/schedule/event/fedoras_legal_state/


Thanks. That what I am looking for.


If I understand the situation correctly, this is actually a rather heavy and unnoticed albatross hanging around Linux's neck: it's hard for a company to ship a working Linux distribution on a laptop sold for profit, because "working" means implementing a number of patented features.


As well as likely distributing firmware which SHOULD just be shipped with the bloody hardware in a small sliver of ROM, or patches to roms which have bugs because of lack of testing, etc.

Also many of the WiFi drivers have such crazy firmware because they're actually (at least partly) software defined radios and thus each country needs a slightly different flavor and that's related to regulations and testing.

Everything would be much easier if we could just have some part of the UN that every country agrees to follow manage a universal spectrum allocation and anyone that disagrees should just expect all of the electronics to break.


> Everything would be much easier if we could just have some part of the UN that every country agrees to follow manage a universal spectrum allocation and anyone that disagrees should just expect all of the electronics to break.

Not sure it would be. As I understood that's more or less how it works today bar the UN bit. Key industry players chatter and come up with standards that all are reasonably happy with. But then throw in a few countries that want to do things differently just for the sake of it, prior spectrum allocation, and protectionist moves, and you end up where we are today...

https://xkcd.com/927/


Err, yeah, good luck with that.

Sad thing is that is is USA that is the problem child in all this. Being largely isolated from Eurasia, and having just a few big neighbors that are easy to convince to play along, they can basically define the spectrum within their broadcast reach as they see fit.

It is basically the same reasoning behind it as why metric is still not the default over there.


> Sad thing is that is is USA that is the problem child in all this. Being largely isolated from Eurasia, and having just a few big neighbors that are easy to convince to play along, they can basically define the spectrum within their broadcast reach as they see fit.

Well, and that works in our situation.

> It is basically the same reasoning behind it as why metric is still not the default over there.

There's also the simple fact that the 'metric' system is just different, not superior in general (i.e., it's better at some things and worse in others). Why impose a bunch of costs for no net benefit? If every other country jumped off a bridge, ought we?


What is the metric system worse at?


Having sufficient factors. The only change I would do (if I could) is to make the metric system use Base-12. That would be something truly better because one-third would now be 4; quarter would be 3; half would 6; three-fourths would be 9. Compare that to 3.3333; 2.5; 5 and 7.5 of something.

Just like who hexadecimal is very natural in 8/16/32/64 bit computing, the "real life" usage of measures would be much easier if it was in Base-12.


Dividing by 2 or 3. Having useful amounts of precision.


By 2? Because dividing 10 or 100 by 2 is harder than 12 by 2?

Three, I'll give you.

Useful amounts of precision is a nothing, if you ask me. We start teaching decimals in third grade, and the only real issue with decimals is weather, for which the difference is saying "80F vs 81F", or "26.7 versus 27.2", whose utility is ... limited.

For distance, the metric system has finer grained units for precision (come on, break down inches: 1/16, 1/8, 3/16, 1/4, 5/16, 3/8, 1/2, etc... are you going to argue that is better than 25.7cm or 257mm?).

I'm not really buying it, as someone who has lived in both worlds.


Yes, two. 1 foot/16 is 3/4 of an inch. 1 m/16 is 6.25 cm.

You can say 1.5 cups instead of 375 mL.


Metric really is at least somewhat better for most things. But the areas where metric is genuinely superior (a lot of engineering, etc.), metric mostly is used already. For the standard stuff that consumers are exposed to, the advantages of metric aren't that great and no one's all that anxious to switch.


No, things would be better if someone (not me, alas, with a nod to the Linus rant) would design, build and market a wifi chip with FOSS firmware.

Software is great exactly because it allows for infinite flexibility, so you don't need to involve the UN when allocating wifi spectrum.


Other way round: you need to comply with the (national) spectrum allocation. I'm not sure it would be even possible to build a FOSS wifi device without infringing any patents. And, as with other OSHW, how much more are people prepared to pay for that open-ness? I suspect very little.


That would probably be illegal for unlicenced use. WiFi firmware the way it's written now is considered hardware (at least in the US) just like the parent of your comment said.


In the US, yes. Ubuntu, VLC and the likes are exempt from this sort of nonsense because they are not registered in the US. I don't know what happens when a US based company like Dell sells laptops with Ubuntu in the US though. They probably would have made some deals.


That's actually easier for a hardware vendor though because they charge money for the product so can factor in licensing costs. Even aside from free software principles, the problem faced by a distro like Fedora is fitting the square peg of paying licensing fees to patent holders through the round hole of providing their software as a free download.

BTW, does anyone know if Canonical still pay licensing fees to cover Ubuntu for this sort of thing? I believe they used to.


I seem to recall that when you install Ubuntu you have to specifically check a box to say you want the proprietary and patent encumbered stuff.

Likely Dell leave that up to the user to install after unboxing.

And that is one reason that Mint got popular, because they took Ubuntu and bundled that stuff right on the ISO.


VLC is free software but still isn't included in Fedora because of patent issues. Ubuntu includes it (Ubuntu MATE even in the default install).


Being in the EU is not a magical bullet against software patents.

https://arstechnica.com/tech-policy/2017/02/blackberry-sues-...


Any organization with a per-unit revenue stream can easily just pay the MPEG-LA etc. "reasonable and non-discriminatory" fees - they're pretty low. It's only a problem for people who want to distribute linux (or anything that plays music/videos, unless it's just a wrapper that reuses the OS's built-in decoders) completely for free.


Which is why Chrome includes an MPEG-4 AVC/H264 decoder, but Chromium and Firefox do not.


Firefox nowadays downloads a blob for decoding H.264, distributed by Cisco. Cisco pays the fees and they've hit the upper cap time ago anyway.

The source for that blob is available, but legally the binary must be distributed by someone, who is paying the fees.


The blob does not decode anything besides Baseline profile. It won't decode any web video.


Completely aside from the content of the article, this is the second subscriber-only LWN.net article I've seen posted in the past week or so, and I'm sure there have been others. Please be careful with the articles you choose to post.

While this may indicate that LWN needs to improve (or create) its paywall, if articles like this lead to new subscriptions they may be able to just chalk it up to "advertising" without breaking limited sharing of articles.


The editor of LWN's statement on subscriber links on HN:

https://news.ycombinator.com/item?id=5689018


As an optimistic anecdote, this being the second such article in a week that I've really enjoyed just pushed me over the edge and I'm now an LWN subscriber. Hopefully I'm not the only one.

I really wasn't familiar with LWN prior to seeing links to subscriber-only articles semi-frequently on HN, and honestly these days I'm embarrassed I didn't know about it sooner as I'm a Linux sysadmin and LWN's weekly edition is just about exactly the news I want to keep up with my job.


Welcome to the lwn.net subscriber gang! I'm an ordinary desktop linux user and have been a subscriber for many years. It has been, and still is, my go-to site for in-depth news on linux, whether on kernel matters or on the linux ecosystem.

I'm the one who posted this article and so far, I have not had any warning mail from lwn.net about posting subscriber only content. But I do take care to try to only post content that I believe is of interest to HN.


I just need to come back here to say, that after reading your comment I subscribed to LWN. Really worth every penny. Thank you!


This is off-topic, please feel free to downvote/delete whatever but I've really not done well trying to find the answer to this question and there seem to be knowledgeable people here.

I'm joining in on a project that uses the Zend framework. The Framework is under the New BSD License.

We'd like our code to be under the same license. Do we just leave things as they are? Do we add our license to the files we create and leave the Zend files as they are? Do we need to add our stuff to all the files, even those that came with Zend?

I apologize if there is an obvious place to go to understand this, I have not been able to find it.


If you're a serious business you need real legal advice.

That said: put the license in the root of your project (as Zend probably does). Put your own copyright headers on any files that you create. Leave Zend's copyright headers on any files you don't modify. Add your own copyright to the a copyright header on any files you do modify.


My hat is off to this guy! License clearance is a pain. It was the single biggest task Blekko had to do after being acquired by IBM was to go through and vet all of the licenses in all of the bits of code and sort them. There was a bunch of tools to help but I don't think I could sign up for a job that had me in a meeting with lawyers twice a week discussing the various ways something ambiguous might be interpreted as the whole job.





Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: